Question about Over the Air update in NCS_V2

RE: Question about Over the Air update in NCS_V2

Midhunjac — Tue, 24 Jan 2023 12:25:14 GMT

Okay. Got it. I will open a new ticket. Thanks for the inputs so far. Upvoting helpful answer and closing the case.

RE: Question about Over the Air update in NCS_V2

Menon — Tue, 24 Jan 2023 10:59:59 GMT

Hello,

This happens when your application is too large and swapping is not possible because of that. I am confused because image update won't happen if this error persist.

Could you please create new ticket mentioning this as the problem because this is deviating from your parent question. This also helps the other users and to keep the Devzone clean.

Kind Regards,

Abhijith

RE: Question about Over the Air update in NCS_V2

Midhunjac — Mon, 23 Jan 2023 14:58:23 GMT

I could get the whole encryption and OTA functionality working, thanks to your guidance. However, there is also one slight problem. My application image is a bit too much and so, during the swapping, it fails.

I am aware that I have an option to move the second image to an external flash. But the thing is, changing the whole layout to accommodate an external flash is not a really feasible idea. I could get this working by disabling the logging module CONFig_LOG=n and I saved almost 40kb. But it would suit the application to have the logger enabled.

Is there any other way I can get the application image reduced or get the image swap to be successful ? My application is built on the peripheral_uart sample.

Edit : Also, I noticed that once I upload an image successfully and the swapping is all done, the SMP service will no longer be active until I reboot the device. The SMP service will be listed in the NRF Connect android application but in the NRF Device manager application, the device wont show up until there the device is rebooted. Is that a normal response for an invalid image ?

Thank you.

RE: Question about Over the Air update in NCS_V2

Menon — Wed, 18 Jan 2023 14:13:57 GMT

Hello,

[quote user="Midhunjac"]CONFIG_BOOT_SIGNATURE_KEY_FILE="priv.pem"[/quote]

In this configuration you need to mention the full path length of the key file. I assume you are only using MCUboot( bit confused as the thread you shared is from bootloader chain).

As a starting point take a look at this repo from my colleague which explains how to work with custom key. Take a look at the generating key section which gives you more idea on this.

Let me know if you are still struggling.

Kind Regards,

Abhijith

RE: Question about Over the Air update in NCS_V2

Midhunjac — Tue, 17 Jan 2023 18:35:51 GMT

i get it now. MCUboot works fine. I can update via Bluetooth too. However, I need to add encryption too to this implementation. I have a ECDSA256 key and I want to add it to the MCUboot implementation. I am following this thread. However, I have a few problems while building. I am not building this as a child image. Should I compulsorily build it as a separate child image ?

Assuming that I need not, I went ahead and tried the following

When I tried setting this kConfig option,

CONFIG_BOOT_SIGNATURE_KEY_FILE="priv.pem"

the value was not set successfully and I understood that this option must be set for it to work.

CONFIG_MCUBOOT_HEX_FILE=""

But I have not built any images for MCUboot to give as a hex path to this option. So i tried building the MCUboot with this as a reference. However I ran into errors while building MCUboot.

Also, while working through this thread, when I tried to set the key type using the option

CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y

I could not find any such option in the Kconfig. Is that a deprecated one or am I doing something wrong ?

I did find this in the \bootloader\mcuboot\boot\zephyr\prj.conf

CONFIG_BOOT_ENCRYPT_EC256=n

Is it the same thing as above ?

I do not know if I am in the right path here. Please correct me if I am wrong at any point.

RE: Question about Over the Air update in NCS_V2

Midhunjac — Tue, 17 Jan 2023 14:19:26 GMT

Hi Abhijith,

Thanks for the update. i will take a look into these threads and try them and get back to you. Thanks!

RE: Question about Over the Air update in NCS_V2

Menon — Tue, 17 Jan 2023 12:51:42 GMT

Hello,

While reading all your old threads I guess you are bit confused on 1st stage and 2nd stage bootloaders. I can see that your use case is only to update the Application via OTA DFU. For this you don't need a Second stage bootloader. You only want to include bootloader chain if you only want to update the bootloader itself while doing the upgrade. See our Secure bootloader chain section

Take a look at this blog which will give you more idea on adding MCUboot to the application. IF you check the testing section it will show you how you can do the DFU via Bluetooth.

Please let me know if you need anymore clarification.

Kind Regards,

Abhijith

RE: Question about Over the Air update in NCS_V2

Menon — Mon, 16 Jan 2023 14:31:40 GMT

Hello,

Hieu is away for a week and from here on I will be the one handling this case.

[quote user="Midhunjac"]To use a custom key for MCUboot, I need to use CONFIG_BT_SIGNATURE_KEY_FILE="path to private key" . But from what I have learned, MCUBoot is not built from source.So where does the public key come from ? How can I embed my custom public key into MCUboot ?[/quote]

AFAIK, the public key is generated from the private key. For getting a better idea on this please read the Design,Encryption and Image signing section.
Take a look at this ticket from my colleague which shows how you can embed this in the MCUboot. Please let me know If this not what you were looking for.

I need to confirm few things before answering the 4th question. I will answer it tomorrow.

Kind Regards,

Abhijith

RE: Question about Over the Air update in NCS_V2

Hieu — Sat, 14 Jan 2023 21:23:23 GMT

[quote user="Midhunjac"]So, from what I understand now, OTA DFU is easily done if my first stage immutable bootloader is MCUboot. right ?[/quote]

That's right. OTA DFU is relatively easily done if your first stage immutable bootloader is MCUboot (and if you use a NSIB - MCUboot chain, like you previously discovered).

Also, to answer your previous question 4, here are a few relevant reference sources:

My colleague made a guy for adding OTA DFU to an application here:
Add DFU support to your application
Zephyr's SMP Server sample

I need to double check a few things before I can be sure of the answers your previous question 2 and 3. I should be back with those answers before next week.
Please feel free to comment here if you have anymore questions in the mean time though.

RE: Question about Over the Air update in NCS_V2

Midhunjac — Wed, 11 Jan 2023 23:10:51 GMT

[quote userid="9456" url="~/f/nordic-q-a/95121/question-about-over-the-air-update-in-ncs_v2/404418"]Is there a reason you choose NSIB over MCUboot as the first stage bootloader?[/quote]

There is no specific reason for this choice.

So, from what I understand now, OTA DFU is easily done if my first stage immutable bootloader is MCUboot. right ? In that case, would I have to go for a second stage bootloader ?

RE: Question about Over the Air update in NCS_V2

Hieu — Wed, 11 Jan 2023 20:27:49 GMT

OTA DFU can theoretically be done with either NSIB or MCUboot as the first stage (and immutable) bootloader.

I should have phrased my question better. Is there a reason you choose NSIB over MCUboot as the first stage bootloader?

Using MCUboot as the only bootloader, there are various built-in toolchain and libraries support to make enabling OTA DFU easy.

Using NSIB as the only bootloader, I have not found any such support. I am asking our internal teams to see if I may be missing anything here.

RE: Question about Over the Air update in NCS_V2

Midhunjac — Wed, 11 Jan 2023 20:03:16 GMT

[quote userid="9456" url="~/f/nordic-q-a/95121/question-about-over-the-air-update-in-ncs_v2/404413"]From your choice of words, it seems that you just want NSIB to be the immutable bootloader, and don't really need a second stage bootloader. Is that right?[/quote]

Right. I do NOT want a second stage bootloader.. As I told, my end goal is over-the-air firmware update using NRF Secure Immutable bootloader. I will take anything to help me get this. That is all.

But as I understand from the docs, OTA cannot be done with NRF Secure Immutable bootloader. Or am I understanding it wrong ?

[quote userid="9456" url="~/f/nordic-q-a/95121/question-about-over-the-air-update-in-ncs_v2/404413"]can I ask why you would like to use NSIB as the immutable bootloader and not MCUboot?[/quote]

My updates does not involve updating the bootloader. It only updates my application. And from this page, I believe that in this case, first stage immutable bootloader is what I want. Again, if I am wrong in my understanding, please correct me. The whole information is a lot and is vague in my mind.

Thank you

RE: Question about Over the Air update in NCS_V2

Hieu — Wed, 11 Jan 2023 19:30:55 GMT

From your choice of words, it seems that you just want NSIB to be the immutable bootloader, and don't really need a second stage bootloader. Is that right?

While I research this use case, can I ask why you would like to use NSIB as the immutable bootloader and not MCUboot?

RE: Question about Over the Air update in NCS_V2

Midhunjac — Tue, 10 Jan 2023 20:09:16 GMT

I did a bit of research and I have a few questions. What I want to achieve is over-the-air firmware update using NRF Secure Immutable bootloader. I am using nrf52832 and 840 and NCSV2.1.0

What i understand from the docs is that to use OTA updates with NSIB, I should include MCUboot as a second stage bootloader because NSIB does not support this and I do not have any other option. Am I right here ? Is what i am trying possible ? If I am right, are there any samples incorporating these ideas ?
To use a custom key for MCUboot, I need to use CONFIG_BT_SIGNATURE_KEY_FILE="path to private key" . But from what I have learned, MCUBoot is not built from source.So where does the public key come from ? How can I embed my custom public key into MCUboot ?
If I am right about (1), then my MCUboot and NSIB will be my projects two child images. Does this mean that every time I try to update my project I will have to build fresh images of signed MCUboot and NSIB ?
Also I found this sample for OTA. But that is only for nrf9160. Is it because other devices does not support it that the sample is not provided for others or is it because of some other reason ? Can I follow the example and use it on my nrf52832 and 840 ?

Thank you for your time.

RE: Question about Over the Air update in NCS_V2

Midhunjac — Fri, 23 Dec 2022 10:50:30 GMT

Okay. Thanks. I'll take a look at these and come back if I have any questions. Thanks again !!

RE: Question about Over the Air update in NCS_V2

Hieu — Fri, 23 Dec 2022 10:29:49 GMT

As you say you are moving from the nRF5 SDK, I assume you want DFU over BLE when you say OTA.

There are two resources you can refer to for adding DFU over BLE:
- Zephyr SMP Server sample, where you can enable BLE support.
- Our colleague Simon's guide, with instructions to add DFU to a BLE application.

RE: Question about Over the Air update in NCS_V2

Midhunjac — Thu, 22 Dec 2022 21:26:13 GMT

Hi, Thanks for the reply.

I have upgraded my device to the NCS based application. I now need to run OTA updates on this. Is there some kind of guide which I can use as a starting point for my purpose ? I understand that the solution may not be the exact same as the one in NRF5 but that is okay. I am willing to make changes. I just need some documentation or example to use as a reference. Is there something like that ?

RE: Question about Over the Air update in NCS_V2

Hieu — Thu, 22 Dec 2022 20:26:03 GMT

Hi Midhunjac,

NCS v2.x supports OTA updates.

If you are asking if NCS v2.x support the same OTA solution as the nRF5 SDK, then no.

If you are asking if a nRF5 SDK device can be OTA upgrade to a NCS firmware, then theoretically yes. However, there are no official documentations and samples for it.

Hieu